Azure Management and governance built-in role

Site Recovery Operator

Executes and manages Site Recovery test failover, failover, reprotection, and failback operations without enabling or disabling replication, registering new infrastructure, creating or deleting vaults, or assigning access. It has no DataActions.

Control-plane actions (59)

• Microsoft.Authorization/*/read
• Microsoft.Insights/alertRules/*
• Microsoft.Network/virtualNetworks/read
• Microsoft.RecoveryServices/locations/allocatedStamp/read
• Microsoft.RecoveryServices/locations/allocateStamp/action
• Microsoft.RecoveryServices/Vaults/extendedInformation/read
• Microsoft.RecoveryServices/Vaults/read
• Microsoft.RecoveryServices/Vaults/refreshContainers/read
• Microsoft.RecoveryServices/Vaults/registeredIdentities/operationResults/read
• Microsoft.RecoveryServices/Vaults/registeredIdentities/read
• Microsoft.RecoveryServices/vaults/replicationAlertSettings/read
• Microsoft.RecoveryServices/vaults/replicationEvents/read
• Microsoft.RecoveryServices/vaults/replicationFabrics/checkConsistency/action
• Microsoft.RecoveryServices/vaults/replicationFabrics/read
• Microsoft.RecoveryServices/vaults/replicationFabrics/reassociateGateway/action
• Microsoft.RecoveryServices/vaults/replicationFabrics/renewcertificate/action
• Microsoft.RecoveryServices/vaults/replicationFabrics/replicationNetworks/read
• Microsoft.RecoveryServices/vaults/replicationFabrics/replicationNetworks/replicationNetworkMappings/read
• Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/read
• Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectableItems/read
• Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/applyRecoveryPoint/action
• Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/failoverCommit/action
• Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/plannedFailover/action
• Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/read
• Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/recoveryPoints/read
• Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/repairReplication/action
• Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/reProtect/action
• Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/switchprotection/action
• Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/testFailover/action
• Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/testFailoverCleanup/action
• Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/unplannedFailover/action
• Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/updateMobilityService/action
• Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectionContainerMappings/read
• Microsoft.RecoveryServices/vaults/replicationFabrics/replicationRecoveryServicesProviders/read
• Microsoft.RecoveryServices/vaults/replicationFabrics/replicationRecoveryServicesProviders/refreshProvider/action
• Microsoft.RecoveryServices/vaults/replicationFabrics/replicationStorageClassifications/read
• Microsoft.RecoveryServices/vaults/replicationFabrics/replicationStorageClassifications/replicationStorageClassificationMappings/read
• Microsoft.RecoveryServices/vaults/replicationFabrics/replicationvCenters/read
• Microsoft.RecoveryServices/vaults/replicationJobs/*
• Microsoft.RecoveryServices/vaults/replicationPolicies/read
• Microsoft.RecoveryServices/vaults/replicationRecoveryPlans/failoverCommit/action
• Microsoft.RecoveryServices/vaults/replicationRecoveryPlans/plannedFailover/action
• Microsoft.RecoveryServices/vaults/replicationRecoveryPlans/read
• Microsoft.RecoveryServices/vaults/replicationRecoveryPlans/reProtect/action
• Microsoft.RecoveryServices/vaults/replicationRecoveryPlans/testFailover/action
• Microsoft.RecoveryServices/vaults/replicationRecoveryPlans/testFailoverCleanup/action
• Microsoft.RecoveryServices/vaults/replicationRecoveryPlans/unplannedFailover/action
• Microsoft.RecoveryServices/vaults/replicationVaultSettings/read
• Microsoft.RecoveryServices/Vaults/monitoringAlerts/*
• Microsoft.RecoveryServices/Vaults/monitoringConfigurations/notificationConfiguration/read
• Microsoft.RecoveryServices/Vaults/storageConfig/read
• Microsoft.RecoveryServices/Vaults/tokenInfo/read
• Microsoft.RecoveryServices/Vaults/usages/read
• Microsoft.RecoveryServices/Vaults/vaultTokens/read
• Microsoft.ResourceHealth/availabilityStatuses/read
• Microsoft.Resources/deployments/*
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.Storage/storageAccounts/read
• Microsoft.Support/*

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign at the Recovery Services vault containing the protected items and recovery plans the operator may run. Target compute, network, storage, and resource-group permissions required by the recovery operation remain separate.

Common use cases (2)

• Run a planned or unplanned failover when instructed during an incident or disaster-recovery drill.
• Reprotect and fail back recovered virtual machines after the primary site is restored.

Prerequisites (2)

• Replication, recovery plans, target infrastructure, network mappings, and recovery procedures must already be configured by a Site Recovery administrator.
• Application owners and incident leadership must authorize the test or production recovery action.

Best practices (2)

• Assign at the vault to trained disaster-recovery operators and use time-bound access for production failover.
• Test recovery plans, validate target capacity and networking, and record each failover, reprotection, and failback decision.

Security considerations (2)

• Failover and failback can redirect production workloads, create target resources, expose recovered systems, or cause outage and data divergence.
• The role is narrower than Contributor for configuration, but its recovery execution authority remains highly privileged.

Assignment guidance

Assign to trained DR operators at the vault, preferably as eligible access activated for drills or incidents. Keep replication configuration on Contributor and monitoring on Reader.

Related roles (2)

• Site Recovery Contributor: Adds replication and recovery configuration administration.
• Site Recovery Reader: Monitoring-only alternative.

Editorial sources (5)

• Azure built-in roles for Management and governance →

  Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.

• Manage Site Recovery access with Azure role-based access control →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

Official Microsoft Learn documentation →